Executive brief
Zephyr RTOS, used in IoT and embedded devices, has a memory leak vulnerability in its Ethernet bridging feature. An attacker on a bridged network can repeatedly send specially crafted broadcast frames to exhaust the device's packet buffer pool, causing it to stop receiving network traffic until reboot. This results in a denial of service with no data exposure risk.
Technical details
The vulnerability is a packet buffer leak (CWE-401) in the Ethernet bridge input handler eth_bridge_input_process(). When a frame arrives on a bridge member and must be delivered to the local stack, the code incorrectly returns NET_OK (indicating the packet was consumed) without actually taking ownership. The real vulnerability occurs when frames carry an unrecognized EtherType: the L3 dispatch layer fails to overwrite the NET_OK verdict, causing ethernet_recv() to return NET_OK and the packet buffer is never released back to the pool. An unauthenticated attacker on the bridged L2 segment can send broadcast or multicast frames with arbitrary unrecognized EtherTypes; each frame permanently consumes one buffer from the finite RX pool (CONFIG_NET_PKT_RX_COUNT). A sustained broadcast flood exhausts buffers, causing denial of service. The attack requires network adjacency on the bridged segment and does not require authentication. A fix is available that corrects the verdict propagation and uses an output parameter to track the destination interface.
Affected products
- Zephyr Project Zephyr RTOS versions with CONFIG_NET_ETHERNET_BRIDGE enabled
Timeline
- 2026-08-31: disclosed
- other: CVE-2026-14696